n8n shipped guardrails. Here is where a node stops.

Sanitize Text replaces detected values with placeholders. The documentation describes no restore operation, and a generic placeholder carries no identity: distinct values collapse into the same token.

An agent working on masked data cannot give the answer back. Once the email is a placeholder, no downstream step can use it, join on it, or return it to the customer.

Guardrails-style sanitization deletes data. Privent turns ahmet@firma.com into [EMAIL_001] and can restore it. Tokens are typed and indexed, and the real values come back only at sinks you trust.

The node protects the step it sits on. A builder places it by hand, workflow by workflow. Privent's node is placed the same way; the interceptor build of the n8n image is not.

A security team cannot accept hope as a control. One forgotten node on one workflow is an uncovered path for the client's data, and nobody finds out until it matters.

Privent's interceptor build of the n8n image sits in the workflow's own run and sees every node, not only the ones you wired. Swap one image; nothing else changes.

Execution-data redaction is an n8n Enterprise feature, and n8n's own documentation is precise about its scope: it controls what users see in the execution viewer and does not restrict what downstream nodes receive.

The data your client worries about is not the copy in the viewer. It is the copy that leaves through the next HTTP node.

Privent transforms the data itself, inside the flow. What the model receives is the transformed payload, the workflow never stops, and every crossing leaves an audit event.